SEKOIA_Backdoor_Win_Headertip

import "pe"
import "hash"

rule SEKOIA_Backdoor_Win_Headertip : FILE
{
	meta:
		description = "Detect HeaderTip backdoor used by the Chinese threat actor Scarab. This backdoor has its hardcoded C2 in strings"
		author = "Sekoia.io"
		id = "82899406-4ec3-41d2-bcc1-bdd1ee440e77"
		date = "2022-03-25"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/backdoor_win_headertip.yar#L4-L24"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "e1523185eac41a615b8d2af8b7fd5fe07b755442df2836041be544dff6881237"
		hash = "da8a98d9b9a3c176ba44fb69ad0a820a971950e05f1eb0c4bbbf6c2fbb748bdc"
		hash = "63a218d3fc7c2f7fcadc0f6f907f326cc86eb3f8cf122704597454c34c141cf1"
		logic_hash = "289764df590cd2719d4d4e0dd66f7d8ebb4714d42eea4bb76c47a2b867a113de"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$post = "POST" wide
		$ua = "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko" wide

	condition:
		( uint16( 0 ) == 0x5A4D and $post at 7256 and $ua at 7304 and filesize < 10KB ) or pe.imphash ( ) == "60d01115d6baa0f214990c6e19339133" or hash.md5 ( pe.rich_signature.clear_data ) == "48f9cf422144c033e2ca183f72587910"
}